NodeUI is exposed from container's ip address

[etherunit]

Although Docker maps the container IPs on the bridged networking type, network services (not exposed to the NAT hole punching) running inside of the container should not be reachable outside of the host network.

Currently, containers running Mysterium node and created on the default docker network 127.17.x.x (127.17.0.2) are accessible via WebUI (127.17.0.2:4449).

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 128.199.202.77  netmask 255.255.192.0  broadcast 128.199.255.255

[soffokl]

If you don't want to expose node WebUI from the container you need to bind it to the host local interface only.
docker run -p 127.0.0.1:4449:4449 ...

Container IP is always accessible from its host. There is no way to hide it since you have full access to the container and can do everything you want from the host.